CN101765845B - System and method for digital content distribution - Google Patents

Abstract

A method and system for transferring digital content from a server to a storage device is provided. The method includes: encrypting the content using a first key, wherein the server encrypts the content; establishing a secure communication channel between the server and the storage device using a random session key; sending the first key to the storage device via the secure communication channel ; replacing the random session key with the first key; sending the encrypted content to the storage device after replacing the random session key with the first key; decrypting the encrypted content using the first key, wherein the storage device decrypts the encrypting the content; re-encrypting the decrypted content using a second key generated by the storage device; and storing the re-encrypted content at the storage device.

Description

Systems and methods for digital content distribution

technical field

The present invention relates to distribution of digital content.

Background technique

Digital content is pervasively used in today's computing environment. Digital content may be stored on storage devices (also referred to as storage systems), or distributed via electronic communications such as the Internet, peer-to-peer software, email, and the like. The Internet and other communication networks today enable various digital applications and systems (which may be referred to as host systems) to interconnect and exchange digital content with ease. Host systems may include, but are not limited to, personal computers, laptop computers, desktop computers, personal digital assistants (PDAs), mobile phones, MP3 players, DVD players, game consoles, digital recording devices such as digital video cameras, and other .

Digital content is typically stored as electronic files. Digital content files generally include data that can be browsed, listened to, read, played, executed, or used by an end user using an appropriate application or device. Digital content files may include audio files, video files, multimedia content files, software files, electronic books, documents, computer games, databases, applications, or any other type of digital content. Different file formats exist for storing digital content. For example, audio files can be stored using MP3, Wav, RealAudio, and other file formats, while MP4, , RealVideo, and other formats are used to store both audio and video files.

Use of digital content may be protected using digital rights management (DRM). DRM allows people to restrict access to digital content by associating specific permissions with the content. Users may be prohibited from copying, distributing, modifying, selling or performing copyrighted digital content files without receiving appropriate permission from the copyright owner. For example, with respect to an audio file, a license object may grant only paying users permission to play the file, while a different type of license object may grant additional permissions to copy the file and distribute the file. Different DRM standards may be used for different content types and formats, and may provide different methods for distributing digital content and related licenses.

Digital content has commercial value to copyright owners, content providers, and the like. Securing digital content distribution is a challenge because modern networks facilitate the mass distribution of digital content.

Contents of the invention

Various embodiments of the present system and method for protecting digital content have several features, no single one of which is solely responsible for their desirable attributes. Without limiting the scope of the present embodiment as expressed by the following claims, its more salient features will be briefly discussed. After considering this discussion, and particularly after reading the section entitled "Detailed Description" one will understand how the features of this embodiment provide advantages, including more efficiency and increased safety.

In one embodiment, the present system and method for protecting digital content includes the recognition that it is cumbersome and inefficient to have a content server encrypt content multiple times for multiple storage devices. More efficiency and security can be achieved if the storage device performs the task of encrypting and decrypting content.

In light of the above realities, one embodiment of the present system and method for protecting digital content includes a method of transferring digital content from a server to a storage device. According to the method, the server encrypts the content using a first key. A secure communication channel is established between the server and the storage device using a random session key. The server sends the first key to the storage device via a secure communication channel. The server and the storage device replace the random session key with the first key. The server sends encrypted content to the storage device via a secure communication channel. The storage device decrypts the encrypted content using the first key and encrypts the content using the second key. Store the content on a storage device.

Another embodiment of the present system and method for protecting digital content includes a method of transferring digital content from a server to a storage device. According to the method, the server encrypts the content using a first key. A secure communication channel is established between the server and the storage device using a random session key. The server sends the first key to the storage device via a secure communication channel. Establish an open communication channel between the server and the storage device. The server sends encrypted content to the storage device via an open communication channel. The storage device decrypts the encrypted content using the first key and encrypts the content using the second key. Store the content on a storage device.

In another embodiment, a system for transferring digital content is provided. The system includes: a server having access to the content; and a storage device capable of storing the content; wherein the server encrypts the content using a first key; and a random session key is used between the server and the storage device Establish a secure communication channel between; send the first key to the storage device via the secure communication channel; replace the random session key with the first key; send encrypted content to the storage device after replacing the random session key with the first key; And, a cryptographic engine for the storage device decrypts the encrypted content using a first key and re-encrypts the decrypted content using a second key generated by the storage device; and storing the re-encrypted content at the storage device .

In another embodiment, a system for transferring digital content is provided. The system includes: a server having access to the content; and a storage device capable of storing the content; wherein the server encrypts the content using a first key; and a random session key is used between the server and the storage device establish a secure communication channel between them; send the first key to the storage device via the secure communication channel; send the encrypted content to the storage device via an open channel; and the cryptographic engine for the storage device decrypts the encrypted content using the first key And re-encrypting the decrypted content using the second key generated by the storage device; and storing the re-encrypted content at the storage device.

In another embodiment, a storage device for securely storing digital content is provided. The storage device includes: a cryptographic engine for decrypting and encrypting the content; wherein, the server encrypts the content using a first key; a secure communication channel is established between the server and the storage device using a random session key; the storage device sends the first key; replaces the random session key with the first key; sends encrypted content to the storage device after replacing the random session key with the first key; and, the cryptographic engine uses the first key decrypting the encrypted content and re-encrypting the decrypted content using a second key generated by the storage device; and the storage device storing the re-encrypted content.

In another embodiment, a storage device for securely storing digital content is provided. The storage device includes: a cryptographic engine for encrypting and decrypting the content; wherein, the server encrypts the content using a first key; uses a random session key to establish a secure communication channel between the server and the storage device; the storage device sends a first key; sends encrypted content to the storage device via an open channel; and, the cryptographic engine decrypts the encrypted content using the first key and re-encrypts using a second key generated by the storage device the decrypted content; and storing the re-encrypted content at the storage device.

A brief summary has been provided so that the features of this description can be quickly understood. A more complete understanding of this description can be gained by referring to the following detailed description of various embodiments in conjunction with the accompanying drawings.

Description of drawings

Preferred embodiments of the present system and method for protecting digital content will now be discussed in detail, emphasizing the salient advantageous features. These embodiments describe novel and inventive systems and methods that are shown in the drawings, which are used for illustration purposes only. These drawings include the following figures, wherein like numbers indicate like parts:

Figure 1 is a schematic block diagram of an existing system for protecting digital content;

Figure 2A is a schematic block diagram of one embodiment of the present systems and methods for protecting digital content;

Fig. 2B is the block diagram of controller;

Figure 3 is a flowchart illustrating one embodiment of the present method for protecting digital content; and

Figure 4 is a flowchart illustrating another embodiment of the present method for protecting digital content.

Detailed ways

To facilitate understanding of various embodiments, the general architecture and operation of a system for distributing digital content will first be described. The specific architecture and operations will then be described with reference to this general architecture.

As used in this disclosure, the terms "module," "system," "component," etc., are intended to refer to a computer-related entity, hardware, or a combination of hardware and software, software, or software in execution. For example, a module may be, but is not limited to being, a process running on a processor, a processor, a state machine implemented in hardware, software, or a combination thereof, an object, an executable, a thread of execution, a program, and/or a computing system. In accordance with the claimed subject matter, computer-executable components/modules may be stored on, for example, computer-readable media including, but not limited to, ASIC (Application-Specific Integrated Circuit), CD (Compact Disc), DVD (Digital Video Disc), ROM (Read Only Memory), Floppy Disk, Hard Disk, EEPROM (Electrically Erasable Programmable Read Only Memory), and Memory Stick.

Figure 1 illustrates an example of a system 100 for protecting content in a storage device. System 100 includes server 102 that stores digital content 104 (which may be referred to as content 104). Content 104 may be stored locally at server 102 or accessible to server 102 via a network connection (not shown). Server 102 communicates with computing system (which may be referred to as a “host system”) 108 via secure channel 110 . Server 102 in communication with host system 108 typically generates a session key (not shown). A storage device (SD) 114 coupled to, accessible by, or integrated in host 108 stores content 104 .

To transfer the content 104 to the SD 114 in a secure manner, the server 102 typically encrypts the content 104 using a server-generated encryption key 106. Server 102 then sends encryption key 106 and the encrypted content to SD 114 using secure channel 110. Unfortunately, in conventional systems, a different key 106 is used to encrypt content 104 whenever content 104 is transferred. The properties and type of encryption key 106 may vary depending on the type of SD 114. Therefore, when the server 102 transfers the content 104 to multiple SDs, the server 102 can encrypt the content differently to suit the needs of the different SDs. This is an unnecessary burden on commercial distribution of digital content. Adaptive embodiments described herein alleviate this burden.

Figure 2A illustrates a simplified block diagram of one embodiment of the present system 200 for securely transferring digital content. The system 200 includes a server 202 that stores encrypted content 204 . Server 202 encrypts content 204 using encryption key 206 . Server 202 does not encrypt content each time it must communicate with a different type of storage device, as described below.

Server 202 communicates with host system 208 via secure channel 210 . Secure Tunnel 210 facilitates secure communications by using random session keys. The random session key may be based on random numbers generated by both server 202 and host system 208 . Random numbers can be generated through the use of dedicated hardware, software, or a combination thereof.

In some embodiments, server 202 may communicate with host system 208 via open channel 212 . Open channels 212 are unsecured and typically faster than secured channels 210 .

In embodiments that include both the secure channel 210 and the open channel 212, the secure channel 210 and the open channel 212 may be capable of transferring data between the server 202 and the host system 208/SD 214 at the same time. Alternatively, secure channel 210 and open channel 212 may not operate simultaneously.

In one embodiment, server 202 establishes secure channel 210 using a random session key.

Host system 208 (as well as server 202) typically includes various functional components. These components may include processors (also referred to as central processing units (CPUs)), memory, I/O devices, and others. The memory is coupled to the CPU via a system bus or a local memory bus. Memory is used to provide CPU access to data and program information at execution time. Typically, memory consists of random access memory (RAM) circuits. A computer system with a CPU and memory is often referred to as a host system. The term host system as used herein includes personal computers (PCs), laptop and other portable computers, cellular telephones, personal digital assistants (PDAs), digital still cameras, digital movie cameras, portable audio players, and the like.

SD 214 includes a controller 215 and a cryptographic engine 220. Controller 215 controls the overall operation of SD 214 and interfaces with host 208 via host interface 215D (FIG. 2B). The cryptographic engine (or module) 220 encrypts and decrypts content, and includes an encryption module 220A and a decryption module 220B. Encryption and decryption can be based on any encryption/decryption technique such as AES (Advanced Encryption Standard), DES (Data Encryption Standard), 3DES and others. The adaptive embodiments disclosed herein are not based on any particular type of encryption/decryption technique.

Server 202 sends encryption key 206 to SD 214 via secure channel 210 in a random session using the random session key. The random session key ensures secure transfer of the encryption key 206 which is used to decrypt the encrypted content 204 . After the encryption key 206 is transferred, the random session key is replaced by the encryption key 206, and then the encrypted content 204 is transferred to the SD 214. Decryption module 220B decrypts encrypted content 204 using key 206 . Then, the encryption module 220A encrypts the decrypted content based on the SD-generated encryption key 222 .

SD 214 may be any type of storage device, such as a non-volatile memory storage device, a hard disk, or any other type of storage device. In one embodiment, SD 214 is a removable, non-volatile memory device (including a flash memory card) with a solid-state memory module (or unit). Currently preferred is the NAND architecture for the memory cell array, although other architectures, such as NOR, could be used instead.

There are currently many different non-volatile memory cards commercially available, examples being Compact Flash (CF), Multimedia Card (MMC), Secure Digital (SD), Mini SD, Memory Stick, SmartMedia and TransFlash Card. While each of these cards has a unique mechanical and/or electrical interface according to its standard specification (e.g., an interface based on the Universal Serial Bus (USB) specification, which is hereby incorporated by reference in its entirety), in The flash memory included in each is very similar. These cards are available from SanDisk Corporation, the assignee of this application.

SanDisk also offers a line of flash drives under its Cruzer trademark that have a Universal Serial Bus (USB) plug for connecting to a host computer by plugging into the host's USB receptacle (not shown). Handheld memory system in a small package. Each of these memory cards and flash drives includes a controller that interfaces with a host and controls the operation of the flash memory therein. The host typically includes built-in sockets for one or more types of memory cards or flash drives, although some hosts may use adapters into which memory cards are inserted.

In the illustrated embodiment, SD 214 also includes a general storage module (or segment) 216 and a secure storage module (or segment) 218. In some approaches, SD 214 may store encrypted content 204 (e.g., encrypted with server-generated encryption key 206) in general storage module 216 and store server-generated encryption key 206 in secure storage module 218.

In one embodiment, SD 214 appears to host system 208 as multiple logical units (LUNs) of storage space, and each LUN may appear to be a different type of storage device. For example, SD 214 may appear to have both standard Mass Storage Class (Mass Storage Class) volumes that mimic the characteristics of SCSI hard drives, and MMC Class volumes that mimic those of CD-ROMs. characteristic. Secure storage 218 is a hidden area, access to which is based on proper authentication.

FIG. 2B shows a block diagram of the architecture of the controller module 215 . The controller module 215 includes a microcontroller 215B that interfaces with various other components via interface logic 215A. Memory 215C stores firmware and software instructions used by microcontroller 215B to control the operation of SD 214. Memory 215C may be volatile reprogrammable random access memory (“RAM”), non-volatile reprogrammable memory (“ROM”), one-time programmable memory, or reprogrammable flash electrically erasable Programs read-only memory ("EEPROM"). The host interface 215D interfaces with the host system 208 and the memory interface 215E interfaces with a memory module (not shown).

In one embodiment of the method for transferring digital content, the server 202 encrypts the content 204 using the encryption key 206 generated by the server, as shown in step S300 in FIG. 3 . In step S302, a secure channel 210 is established between the server 202 and the SD 214 using a random session key. The server 202 sends the encryption key 206 generated by the server to the SD 214 via the secure channel 210, as shown in step S304. The server 202 and the storage device 214 replace the random session key with the server-generated encryption key 206 at step S306. The server 202 sends the encrypted content 204 via the secure channel 210, as shown in step S308.

The encryption engine 220 uses the encryption key 206 generated by the server to decrypt the content 204 encrypted by the server, as shown in step S310 in FIG. 3 . At step S312, the cryptographic engine 220 then re-encrypts the content using the SD-generated encryption key 222, and then the content is stored as SD-encrypted content 224 at step S314. SD encrypted content 224 may be stored in general storage module 216 , while SD generated encryption key 222 may be stored in secure storage module 218 .

Figure 4 illustrates an alternative method for transferring digital content. The server 202 encrypts the content 204 using the encryption key 206 generated by the server, as shown in step S400 in FIG. 4 . In step S402, a secure channel 210 is established between the server 202 and the SD 214 using a random session key. The server 202 sends the encryption key 206 generated by the server to the SD 214 via the secure channel 210, as shown in step S404. Then, at step S406 the server 202 and the storage device 214 establish an open channel 212 . The server sends the encrypted content 204 via the open channel 212, as shown in step S408. The encryption engine 220 uses the encryption key 206 generated by the server to decrypt the content 204 encrypted by the server, as shown in step S410 in FIG. 4 . At step S412, the cryptographic engine 220 then re-encrypts the content using the SD-generated encryption key 222, and at step S414, the content is stored as SD-encrypted content 224.

In the systems 200 and methods described above, the server 202 advantageously only encrypts the content 204 once, and may encrypt the content 204 according to any encryption mechanism the server 202 chooses. This content 204 is then decrypted by the SD 214 using the server-generated encryption key 206, re-encrypted by the SD 214 using the SD-generated encryption key 222, and stored in the SD 214 as SD-encrypted content 224. The SD 214 can encrypt the content 224 according to its own encryption mechanism, so that the server 202 is relieved from this task. Thus, the present system 200 is more efficient than existing systems in which a server is burdened with encrypting multiple content packages according to multiple encryption mechanisms. Additionally, the SD-encrypted content 224 is encrypted using an SD-generated encryption key 222 known only to the SD 214. Therefore, the content 224 is very secure.

The foregoing description, presented in sufficient, clear, concise and precise terms to enable those skilled in the art to make the systems and use the methods, is conceived to implement the present systems and methods for protecting digital content, and to make and use them methods and the best way to deal with them. However, the systems and methods are susceptible to modifications and alternative constructions that are fully equivalent to those disclosed above. Accordingly, the systems and methods are not limited to the particular embodiments disclosed. On the contrary, the systems and methods cover all modifications and alternative constructions coming from the spirit and scope of the systems and methods as generally expressed by the following claims which particularly point out and distinctly claim the subject matter of the systems and methods.

Claims (19)

1. A method of processing digital content in a storage device, the method comprising the steps of: encrypting the digital content using a first key, wherein the server encrypts the digital content; Establish a secure communication channel between the server and the storage device using a random session key; sending the first key to the storage device via a secure communication channel; replacing the random session key with the first key; sending the encrypted digital content to the storage device after replacing the random session key with the first key; decrypting the encrypted digital content at the storage device using the first key; re-encrypting the decrypted digital content at the storage device using a second key generated by the storage device; and storing the re-encrypted content at the storage device, Wherein the second key is only known by the storage device. 2. The method of claim 1, wherein the server generates the first key. 3. The method of claim 1, wherein the re-encrypted content is stored in a general storage module of the storage device. 4. The method of claim 1, further comprising storing a second key in the storage device. 5. The method of claim 1, wherein the second key is stored in a secure storage module of the storage device. 6. The method of claim 1, wherein the storage device is a non-volatile memory device. 7. A method of transferring digital content, the method comprising the steps of: encrypting the digital content using a first key, wherein the server encrypts the digital content; Establish a secure communication channel between the server and the storage device using a random session key; sending the first key to the storage device via a secure communication channel; establishing an open communication channel between the storage device and the server; sending encrypted digital content to the storage device via the open communication channel; decrypting the encrypted digital content at the storage device using the first key; re-encrypting the decrypted digital content at the storage device using a second key generated by the storage device; and storing the re-encrypted digital content at the storage device, Wherein the second key is only known by the storage device. 8. The method of claim 7, wherein the re-encrypted digital content is stored in a general storage module of the storage device. 9. The method of claim 7, further comprising the step of storing a second key on the storage device. 10. The method of claim 7, wherein the second key is stored in a secure storage module of the storage device. 11. The method of claim 7, wherein the storage device is a non-volatile memory device. 12. A system for transferring digital content comprising: means configured to cause the server to encrypt the digital content stored in the storage device using the first key; means configured to cause the server to establish a secure communication channel between the server and the storage device using a random session key; means configured to cause the server to send the first key to the storage device via a secure communication channel; means configured to cause the server to establish an open channel between the server and the storage device; means configured to cause the server to send encrypted digital content to a storage device via the open channel; means configured to cause a cryptographic engine included in the storage device to decrypt the encrypted digital content using the first key to generate decrypted digital content; means configured to cause the cryptographic engine to re-encrypt the decrypted digital content at the storage device using a second key generated by the storage device; and means configured to cause the cryptographic engine to store the re-encrypted digital content at a storage device, Wherein the second key is only known by the storage device. 13. The system of claim 12, wherein the first key is generated by the server. 14. The system of claim 12, wherein the re-encrypted digital content is stored in a general storage module of the storage device. 15. The system of claim 12, wherein the second key is stored in a secure storage module of the storage device. 16. The system of claim 12, wherein the storage device is a non-volatile memory device. 17. The method of claim 1, wherein the first key is independent of a type of storage device. 18. The method of claim 1, wherein the storage device comprises a flash memory card. 19. The method of claim 7, wherein the storage device comprises a flash memory card.